PhishingPublished 27 May 2026

Attackers leveraging Google AppSheet notifications to hijack accounts | Kaspersky official blog

Source Kaspersky Security Blog

Description

Threat actors are exploiting legitimate Google AppSheet addresses for phishing campaigns, sending emails on behalf of major companies to steal user credentials.

Impact

Successful phishing attacks lead to theft of personal data, user credentials, and full account takeover. Compromised accounts can be sold on the dark web or used for further targeted attacks. In cases involving Apple IDs, attackers may gain remote control of victims' devices, locking them out and potentially demanding ransom. The phishing emails bypass spam filters due to originating from a legitimate Google domain, increasing the likelihood of user interaction. The emotional manipulation tactics increase victim susceptibility. There is no direct vulnerability in AppSheet itself; rather, the threat arises from abuse of its legitimate email sending capabilities.

Defensive guidance

Users should be vigilant when receiving emails from noreply@appsheet.com, especially if claiming to be from major companies. Verify sender email addresses carefully and do not trust display names alone. Avoid clicking links or providing credentials in unsolicited emails. Use security solutions like Kaspersky Premium that detect phishing emails and block access to spoofed websites. Employ password managers to prevent autofilling credentials on suspicious domains. Enable two-factor authentication or use passkeys to protect accounts even if credentials are compromised. Cross-reference communications with official company contact channels before responding or providing information.

References

kaspersky.com/blog/appsheet-phishing-emails/55827/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 May 2026, 16:12 UTC

References

Community reviews